Does anyone have experience with their VSCode extension, does it work just as well as the official SSH remote extension?
Tailscale SSH is now Generally Available
41–50 of 98 posts
Re: Tailscale SSH is now Generally Available
#42Iiuc, atm tailscale ssh X11 forwarding doesn't work.
Re: Tailscale SSH is now Generally Available
#43Why does Tailscale need special handling for SSH?
Tailscale gives you authorized connectivity between hosts, and DNS; won't it be sufficient to run plain sshd?
(If wireguard-key-level auth were sufficient, even rlogin or netcat would be enough, because the transport is encrypted already.)
Re: Tailscale SSH is now Generally Available
#44Why does Tailscale need special handling for SSH? Tailscale gives you authorized connectivity between hosts, and DNS; won't it be sufficient to run plain sshd? (If wireguard-key-level auth were sufficient, even rlogin or netcat would be enough, because the transport is encrypted already.)
Tailscale ssh is handling authentication for you so that you do not need to pass around authorized_keys to all hosts. :)
It means you can configure/activate/deactivate peoples access centrally too.
Re: Tailscale SSH is now Generally Available
#45Why does Tailscale need special handling for SSH? Tailscale gives you authorized connectivity between hosts, and DNS; won't it be sufficient to run plain sshd? (If wireguard-key-level auth were sufficient, even rlogin or netcat would be enough, because the transport is encrypted already.)
Tailscale doesn't need special handling for SSH. You can run your plain old sshd just fine.
Tailscale comes with an additional SSH server, which runs in parallel with your other SSH server. It does use Wireguard keys directly, so effectively you don't need to manage keys.
Additionally, this SSH server is implemented in userspace, so it won't (can't) interfere with anything else on your system (like your other sshd).
Re: Tailscale SSH is now Generally Available
#46Why does Tailscale need special handling for SSH? Tailscale gives you authorized connectivity between hosts, and DNS; won't it be sufficient to run plain sshd? (If wireguard-key-level auth were sufficient, even rlogin or netcat would be enough, because the transport is encrypted already.)
[deleted]
Re: Tailscale SSH is now Generally Available
#47Just gonna note this is still a thing https://ssotax.org/
I don't get what's wrong with charging more for SSO? They're in the business of making money, and if you need SSO and you need their service you're more likely to have money. It's nothing to do with the feature itself.
If you're storing passwords for the non-SSO option then you're hurting yourself as well as your customers, because storing passwords is a massive security and operational headache. If your limited SSO options, before charging the SSO tax, are "social" (e.g. Google) logins, then you're letting BigTech in between you and your customers.
I'm all for price discrimination, but SSO is the exception, because the alternative is too expensive.
Re: Tailscale SSH is now Generally Available
#48Why does Tailscale need special handling for SSH? Tailscale gives you authorized connectivity between hosts, and DNS; won't it be sufficient to run plain sshd? (If wireguard-key-level auth were sufficient, even rlogin or netcat would be enough, because the transport is encrypted already.)
It is about using SSO and tagging to auth the users.
So for example you could have instances tagged with {users} that cannot ssh to certain boxes, but other users tagged with {admin} that can. All these users can be part of your tailnet.
Re: Tailscale SSH is now Generally Available
#49I'm sure it's very well done but is it a good idea to give a third party a full access to your infrastructure?
Re: Tailscale SSH is now Generally Available
#50Iiuc, atm tailscale ssh X11 forwarding doesn't work.
you also can't forward ports which kind of makes sense from their security model, but is annoying when wanting to use one host as a bastion